Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2011-046
by security-news＠drupal.org 05 Oct '11

05 Oct '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-046 * Project: Echo [1] (third-party module) * Version: 6.x, 7.x, 8.x * Date: 2011-October-05 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Echo module generates a fully-themed Drupal page, returning the rendered page as a text string and allowing other modules to style an HTML message as if it had been generated by the live website. The module does not properly sanitize user-supplied content, resulting in a Cross-Site Scripting (XSS [3]) vulnerability. Additionally, the module allows arbitrary content passed via the URL to be embedded on the site, rendering the site vulnerable to phishing [4] exploits. -------- VERSIONS AFFECTED --------------------------------------------------- * Echo 6.x-1.x versions prior to 6.x-1.7 [5]. * Echo 7.x-1.x versions prior to 7.x-1.7 [6]. * Echo 8.x-1.x versions prior to 8.x-1.7 [7]. Drupal core is not affected. If you do not use the contributed Echo [8] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Echo module for Drupal 6.x, upgrade to Echo 6.x-1.7 [9]. * If you use the Echo module for Drupal 7.x, upgrade to Echo 7.x-1.7 [10]. * If you use the Echo module for Drupal 8.x, upgrade to Echo 8.x-1.7 [11]. See also the Echo [12] project page. -------- REPORTED BY --------------------------------------------------------- * Francesco Placella (plach [13]) -------- FIXED BY ------------------------------------------------------------ * Bob Vincent (pillarsdotnet [14]) the module maintainer -------- COORDINATED BY ------------------------------------------------------ * mr.baileys [15] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [16]. Learn more about the Drupal Security team and their policies [17], writing secure code for Drupal [18], and securing your site [19]. [1] http://drupal.org/project/echo [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://en.wikipedia.org/wiki/Phishing [5] http://drupal.org/node/1274528 [6] http://drupal.org/node/1274530 [7] http://drupal.org/node/1274532 [8] http://drupal.org/project/echo [9] http://drupal.org/node/1274528 [10] http://drupal.org/node/1274530 [11] http://drupal.org/node/1274532 [12] http://drupal.org/project/echo [13] http://drupal.org/user/183211 [14] http://drupal.org/user/36148 [15] http://drupal.org/user/383424 [16] http://drupal.org/contact [17] http://drupal.org/security-team [18] http://drupal.org/writing-secure-code [19] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-042 Views Bulk Operations - Cross Site Scripting
by security-news＠drupal.org 21 Sep '11

21 Sep '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-042 * Project: Views Bulk Operations (VBO) [1] (third-party module) * Version: 6.x * Date: 2011-September-21 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Views Bulk Operations (VBO) module allows actions and rules to be run on the selected views rows (nodes, terms, user, etc). It also bundles several convenient actions. One of those actions allows the bulk modification of taxonomy terms on a node. When using the "Modify node taxonomy terms" action to modify taxonomy, and the vocabulary has user tagging enabled, the vocabulary help (if any) is shown without being filtered first, leading to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it normally requires the 'administer taxonomy' permission in order to exploit it. -------- VERSIONS AFFECTED --------------------------------------------------- Versions prior to 6.x-1.11 Drupal core is not affected. If you do not use the contributed Views Bulk Operations (VBO) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Bulk Operations module for Drupal 6.x, upgrade to 6.x-1.11 [4] See also the Views Bulk Operations (VBO) [5] project page. -------- REPORTED BY --------------------------------------------------------- * Jim Berry [6] -------- FIXED BY ------------------------------------------------------------ * Karim Ratib [7] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/views_bulk_operations [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/views_bulk_operations [4] http://drupal.org/node/1286778 [5] http://drupal.org/project/views_bulk_operations [6] http://drupal.org/user/240748 [7] http://drupal.org/user/48424 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting
by security-news＠drupal.org 21 Sep '11

21 Sep '11

* Advisory ID: SA-CONTRIB-2011-041 * Project: Hostmaster (Aegir) [1] (third-party module) * Version: 6.x * Date: 2011-September-21 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Hostmaster (Aegir) provides a system for managing Drupal sites. The theme in Hostmaster, Eldir, does not sanitize the custom body classes correctly leading to a cross site scripting (XSS) vulnerability that can be exploited when a user is made to view a specially crafted URL. If the user is logged into an administrative account then the script can take actions using their permissions or disclose sensitive information to a third party. This vulnerability is mitigated by the fact that user being attacked must be logged into Aegir with a privileged account and tricked into visiting a specially crafted URL. -------- VERSIONS AFFECTED --------------------------------------------------- * Hostmaster (Aegir) 6.x-1.x versions prior to 6.x-1.4 [3]. Drupal core is not affected. If you do not use the contributed Hostmaster (Aegir) [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Follow the upgrade instructions in the release notes for the Aegir 1.4 release which can be found at: http://community.aegirproject.org/1.4 [5] Please note that if you have installed Aegir using the debian packages, manual intervention is currently required, and you should read the release notes at the above link for more information. See also the Hostmaster (Aegir) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Khawer Masood and affiliated security team -------- FIXED BY ------------------------------------------------------------ * Steven Jones [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison (greggles) [8] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/hostmaster [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1286402 [4] http://drupal.org/project/hostmaster [5] http://community.aegirproject.org/1.4 [6] http://drupal.org/project/hostmaster [7] http://drupal.org/user/99644 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-040 Author Pane access bypass
by security-news＠drupal.org 07 Sep '11

07 Sep '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-040 * Project: Author Pane [1] (third-party module) * Version: 6.x * Date: 2011-September-7 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Author Pane module provides information about users on a site. This module has integration with several other modules including the user locations of the Location module. If you enabled display of user locations the Author Pane module may have shown user locations to site visitors who did not have the permission "view all user locations" permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Author Pane 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed Author Pane [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Author Pane module for Drupal 6.x, upgrade to Author Pane 6.x-2.2 [4] See also the Author Pane [5] project page. -------- REPORTED BY --------------------------------------------------------- * Tony Brooke (silentway) [6] * Skispcs [7] -------- FIXED BY ------------------------------------------------------------ * Michelle [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/author_pane [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/author_pane [4] http://drupal.org//drupal.org/node/1271388 [5] http://drupal.org/project/author_pane [6] http://drupal.org/user/414872 [7] http://drupal.org/user/667658 [8] http://drupal.org/user/23570 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-039 * Project: Bot Alarm [1] (third-party module) * Version: 6.x * Date: 2011-August-31 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to set alarms for your IRC bot. The module does not properly escape the message and channels of alarms in pages listing the alarms, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'administer bot'. The module does not check for any one-time-use tokens when deleting an alarm, leading to a Cross Site Request Forgery (CSRF ) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'administer bot'. -------- VERSIONS AFFECTED --------------------------------------------------- * Bot Alarm 6.x-1.0 Drupal core is not affected. If you do not use the contributed Bot Alarm [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the bot_alarm module for Drupal 6.x, upgrade to 6.x-1.2 [4] See also the Bot Alarm [5] project page. -------- REPORTED BY --------------------------------------------------------- * CSÉCSY László [6] -------- FIXED BY ------------------------------------------------------------ * Aaron Forsander [7] the module maintainer -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8], Greg Knaddison [9] and Ben Jeavons [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/bot_alarm [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/bot_alarm [4] http://drupal.org/node/1265642 [5] http://drupal.org/project/bot_alarm [6] http://drupal.org/user/199303 [7] http://drupal.org/user/737486 [8] http://drupal.org/user/102818 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/91990 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-037- Node Invite - Cross Site Scripting
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-037 * Project: Node Invite [1] (third-party module) * Version: 6.x * Date: 2011-Augest-31 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Node Invite module allows you to invite users (with existing accounts or otherwise) to specified nodes on a Drupal site. This module does not properly use t() strings to ensure all text was sanitized when data was output through a form_set_error message, thus creating a Cross Site Scripting (XSS) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Node invite 6.x versions prior to 6.x-2.3 [3]. Drupal core is not affected. If you do not use the contributed Node Invite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Invite module for Drupal 6.x, upgrade to node_invite-6.x-2.3 See also the Node Invite [5] project page. -------- REPORTED BY --------------------------------------------------------- * Richard Kapolnai [6] -------- FIXED BY ------------------------------------------------------------ * Scott Hadfield [7] the module maintainer -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/node_invite [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1265334 [4] http://drupal.org/project/node_invite [5] http://drupal.org/project/node_invite [6] http://drupal.org/user/277970 [7] http://drupal.org/user/67093 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-038 - Taxonomy Views Integrator - Cross Site Scripting
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-038 * Project: Taxonomy Views Integrator [1] (third-party module) * Version: 6.x * Date: 2011-Augest-31 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to override whole vocabularies or individual terms with the View of your choice. The module did not filter user entered term descriptions for Cross Site Scripting (XSS) injections. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy". -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Views Integrator 6.x-1.x versions prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed Taxonomy Views Integrator [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy Views Integrator module for Drupal 6.x, upgrade to 6.x-1.2 [4] See also the Taxonomy Views Integrator [5] project page. -------- REPORTED BY --------------------------------------------------------- * Owen Barton [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Derek Webb [7] one of the module's maintainers -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/tvi [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tvi [4] http://drupal.org/node/1264776 [5] http://drupal.org/project/tvi [6] http://drupal.org/user/19668 [7] http://drupal.org/user/64114 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-036 - Addresses - Cross Site Scripting
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-036 * Project: Addresses [1] (third-party module) * Version: 6.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to link your users and contents to physical addresses. The module doesn't sufficiently filter output when displaying an address. This vulnerability is mitigated by the fact that the module doesn't use the single line display by default, an administrator has to enable that feature first. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions prior to 6.x-1.10 Drupal core is not affected. If you do not use the contributed Addresses [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the addresses module for Drupal 6.x, upgrade to 6.x-1.11 [4] See also the Addresses [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Kinzer [6] -------- FIXED BY ------------------------------------------------------------ * David Kinzer [7] * Alexis Wilke [8] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/addresses [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/addresses [4] http://drupal.org/node/1251508 [5] http://drupal.org/project/addresses [6] http://drupal.org/user/619296 [7] http://drupal.org/user/619296 [8] http://drupal.org/user/356197 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-035 Forward module - Open redirect
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-035 * Project: Forward [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Open redirect -------- DESCRIPTION --------------------------------------------------------- The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard code a forward link to an unscrupulous external site. This vulnerability is mitigated by the fact that an attacker must have a role that enables them to post content to the site that contains embedded links. -------- VERSIONS AFFECTED --------------------------------------------------- * Forward 6.x-1.x versions prior to 6.x-1.20. * Forward 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Forward [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Forward module for Drupal 6.x, upgrade to Forward 6.x-1.20 [4] * If you use the Forward module for Drupal 7.x, upgrade to Forward 7.x-1.1 [5] See also the Forward [6] project page. -------- REPORTED BY --------------------------------------------------------- * Christian Schmidt [7] of Berlingske Media -------- FIXED BY ------------------------------------------------------------ * John Oltman [8] the module maintainer * Christian Schmidt [9] of Berlingske Media -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/forward [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/forward [4] http://drupal.org/node/1252132 [5] http://drupal.org/node/1252118 [6] http://drupal.org/project/forward [7] http://drupal.org/user/216078 [8] http://drupal.org/user/699926 [9] http://drupal.org/user/216078 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-033 - iWebkit - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-033 * Project: iWebkit [1] (third-party module) * Version: 6.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- iWebKit is a web toolkit designed to create iPhone and iPod touch compatible websites and webapps. iWebkit does not properly sanitize menu links when displayed, allowing a malicious user to embed scripts in menu items, thus creating a cross site scripting (XSS [3]) vulnerability that may lead to an unauthorized user gaining full administrative access. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer menu" permission. -------- VERSIONS AFFECTED --------------------------------------------------- * iWebkit theme 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed iWebkit [4] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the iWebkit [5] theme for Drupal 6.x, upgrade to iWebkit 6.x-2.2 [6]. See also the iWebkit [7] project page. -------- REPORTED BY --------------------------------------------------------- * Thomas Turnbull (tom_o_t [8]) -------- FIXED BY ------------------------------------------------------------ * Sumit Kataria (sumitk [9]), the theme maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/iwebkit [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/iwebkit [5] http://drupal.org/project/iwebkit [6] http://drupal.org/node/1236722 [7] http://drupal.org/project/iwebkit [8] http://drupal.org/user/125573 [9] http://drupal.org/user/267786 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news